1

Per the syslog-ng admin guide, the log_msg_size defaults to 64k (65536 bytes)

However, I have seen some sample syslog-ng config files (like this one) that drop this to <18k (18192 bytes)

Why would you want to change the default behavior - especially, why would you want to reduce it?

warren
  • 18,369
  • 23
  • 84
  • 135

1 Answers1

0

The main reasoning behind this is resource limitations or legacy use-cases where destinations may not support long messages.

log_msg_size() limits the maximum accepted size of incoming messages. Using it together with the log-fifo-size() and log-iw-size() options, you can roughly estimate the maximum possible memory usage of syslog-ng, so it helps to set an upper limit on memory consumption.

MrAnno
  • 210
  • 1
  • 7
  • OK ... but syslog-ng is distinctly *not* a "legacy use-case": in fact, it's meant to *replace* those legacy syslog collectors :) – warren Aug 12 '22 at 13:17
  • 1
    Indeed. But when syslog-ng is operating as a forwarder, it might make sense. Other than that, it's all about limiting resource allocations. – MrAnno Aug 12 '22 at 21:44
  • wouldn't have thought of using it as a syslog forwarder :) – warren Aug 14 '22 at 03:52